[Bro] accept failed, Too many open files 24
seth at icir.org
Tue Nov 1 13:25:04 PDT 2016
> On Nov 1, 2016, at 11:06 AM, Matt Clemons <matt.clemons at gmail.com> wrote:
> Has anyone had to deal with this issue or have some ideas? Is there some hidden setting in bro where I can set open file limits
There was an issue with file handles being left open when they weren't needed which will be fixed in 2.5 (and is fixed in the 2.5 beta). Also, in 2.5 you can run a cluster with a dedicated "logger" node which should improve some of the cluster behavior with such a large cluster.
I would recommend jumping in and trying out the beta.
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro